Transcript Chapter 8 Network Management Security

Chapter 8
Network Management
Security
Henric Johnson
Blekinge Institute of Technology, Sweden
Revised by Andrew Yang
Net Security
1
Outline
•
•
•
•
Basic Concepts of SNMP
SNMPv1 Community Facility
SNMPv3
Recommended Reading and WEB Sites
Net Security
2
Basic Concepts of SNMP
• An integrated collection of tools for
network monitoring and control.
– Single operator interface
– Minimal amount of separate equipment.
Software and network communications
capability built into the existing equipment
• SNMP key elements:
–
–
–
–
Management station
Managament agent
Management information base
Network Management protocol
• Get, Set and Notify
Net Security
3
Protocol context of SNMP
Net Security
4
Proxy Configuration
Net Security
5
Net Security
6
SNMP v1 and v2
• Trap – an unsolicited message
(reporting an alarm condition)
• SNMPv1 is ”connectionless” since it
utilizes UDP (rather than TCP) as the
transport layer protocol.
• SNMPv2 allows the use of TCP for
”reliable, connection-oriented”
service.
Net Security
7
Comparison of SNMPv1 and SNMPv2
SNMPv1 PDU
SNMPv2 PDU
Direction
Description
GetRequest
GetRequest
Manager to agent
Request value for
each listed object
GetRequest
GetRequest
Manager to agent
Request next value
for each listed
object
------
GetBulkRequest
Manager to agent
Request multiple
values
SetRequest
SetRequest
Manager to agent
Set value for each
listed object
------
InformRequest
Manager to
manager
Transmit
unsolicited
information
GetResponse
Response
Agent to manager
or Manage to
manager(SNMPv2)
Respond to
manager request
Trap
SNMPv2-Trap
Agent to manager
Transmit
unsolicited 8
information
Net Security
SNMPv1 Community Facility
• SNMP Community – Relationship
between an SNMP agent and SNMP
managers.
• Three aspect of agent control:
– Authentication service
– Access policy
– Proxy service
Net Security
9
SNMPv1 Administrative
Concepts
Net Security
10
SNMPv3
• SNMPv3 defines a security capability
to be used in conjunction with SNMPv1
or v2
Net Security
11
SNMPv3 Flow
Net Security
12
Traditional SNMP Manager
Net Security
13
Traditional SNMP Agent
Net Security
14
SNMP3 Message Format
with USM
Net Security
15
User Security Model (USM)
• Designed to secure against:
–
–
–
–
Modification of information
Masquerade
Message stream modification
Disclosure
• Not intended to secure against:
– Denial of Service (DoS attack)
– Traffic analysis
Net Security
16
Key Localization Process
Net Security
17
View-Based Access Control
Model (VACM)
• VACM has two characteristics:
– Determines wheter access to a managed
object should be allowed.
– Make use of an MIB that:
• Defines the access control policy for this
agent.
• Makes it possible for remote configuration
to be used.
Net Security
18
Access control decision
Net Security
19
Recommended Reading and
WEB Sites
• Subramanian, Mani. Network
Management. Addison-Wesley, 2000
• Stallings, W. SNMP, SNMPv1,
SNMPv3 and RMON 1 and 2. AddisonWesley, 1999
• IETF SNMPv3 working group (Web
sites)
• SNMPv3 Web sites
Net Security
20